handoff

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard, non-privileged Git commands (git rev-parse --abbrev-ref HEAD and git status --short) to capture the current repository branch and file status for inclusion in the handoff context.
  • [PROMPT_INJECTION]: The skill facilitates a transition between threads by reading local project files and interpolating their content into a prompt for a new session, creating a surface for indirect prompt injection.
  • Ingestion points: The skill searches for and reads existing plan files in directories like plans/, docs/plans/, or files matching PLAN*.md at the repository root.
  • Boundary markers: It employs a structured template with clear headers (e.g., 'Context:', 'Start by:', 'Carry forward:') to separate environmental metadata from user-provided implementation details.
  • Capability inventory: The skill can create or update Markdown files within the repository and invoke platform-specific thread creation tools.
  • Sanitization: No explicit sanitization or filtering of the content read from planning files is performed before it is passed to the next thread's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 12:48 AM
Security Audit — agent-trust-hub — handoff